From 6b68c04cd613847e4f2bbe1f0cd8a2a13a9d4660 Mon Sep 17 00:00:00 2001
From: Simon Robertshaw <simon@hardwired.org.uk>
Date: Thu, 14 Mar 2013 12:10:56 +0000
Subject: [PATCH] Fix multiple free after merging multiple request objects

---
 src/client/requestbroker/ImageRequest.cpp  | 5 ++++-
 src/client/requestbroker/RequestBroker.cpp | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/client/requestbroker/ImageRequest.cpp b/src/client/requestbroker/ImageRequest.cpp
index 6e4f66c62..778d8b67b 100644
--- a/src/client/requestbroker/ImageRequest.cpp
+++ b/src/client/requestbroker/ImageRequest.cpp
@@ -115,11 +115,14 @@ RequestBroker::ProcessResponse ImageRequest::Process(RequestBroker & rb)
 	{
 
 		//Create a copy, to seperate from the cache
+		std::vector<Request *> children(Children.begin(), Children.end());
+		Children.clear();
+
 		VideoBuffer * myVB = new VideoBuffer(*image);
 		myVB->Resize(Width, Height, true);
 		ResultObject = (void*)myVB;
 		rb.requestComplete(this);
-		for(std::vector<Request*>::iterator childIter = Children.begin(), childEnd = Children.end(); childIter != childEnd; ++childIter)
+		for(std::vector<Request*>::iterator childIter = children.begin(), childEnd = children.end(); childIter != childEnd; ++childIter)
 		{
 			if((*childIter)->Type == Request::Image)
 			{
diff --git a/src/client/requestbroker/RequestBroker.cpp b/src/client/requestbroker/RequestBroker.cpp
index 62e5fd799..68427dcff 100644
--- a/src/client/requestbroker/RequestBroker.cpp
+++ b/src/client/requestbroker/RequestBroker.cpp
@@ -9,6 +9,7 @@
 #include "ImageRequest.h"
 #include "client/Client.h"
 #include "client/GameSave.h"
+#include "graphics/Graphics.h"
 
 //Asynchronous Thumbnail render & request processing
 
@@ -139,8 +140,6 @@ void RequestBroker::FlushThumbQueue()
 	{
 		if(CheckRequestListener(completeQueue.front()->Listener))
 		{
-			std::cout << typeid(*this).name() << " Calling listener: " << completeQueue.front()->Listener.second << std::endl;
-			std::cout.flush();
 			completeQueue.front()->Listener.second->OnResponseReady(completeQueue.front()->ResultObject);
 		}
 		else
@@ -288,6 +287,7 @@ RequestBroker::Request::~Request()
 		delete (*iter);
 		iter++;
 	}
+	Children.empty();
 }
 void RequestBroker::Request::Cleanup()
 {